Quick Security Alert Regarding Bluefish Editor
This will be a quick post because I've been slammed with work lately, but I just wanted to mention something alarming that I discovered the other day. As I started using Bluefish Editor, I started noticing all sorts of extra files on my server with a ~ at the end of the filename (index.php~ as an example). So, I tried typing one of those into my browser and, to my alarm, found that my server was displaying the raw PHP code! Of course, this is a huge security risk. So, here's how I fixed it:
- I disabled the auto-backup feature in the editor. In Bluefish, this was just an option in the preferences menu. Note: I have no idea why they would have this as a default setting. It makes no sense to me. Anyway...
- I deleted all of those extra files I could find.
- I modified the .htaccess file to prevent any of them that I missed in the cleanup from being displayed. By adding this code to your highest level .htaccess, you'll now get a forbidden 403 when attempting to access:
<Files ~ "~$">
Order allow,deny
Deny from all
</Files>
Hope that helps someone out there.